PHP Form Data Validation and Filtering Techniques

With the development of the Internet, forms have become a crucial component for user interaction with websites, and ensuring the security and validity of form data is essential for developers. Using PHP functions for form data validation and filtering can effectively prevent malicious input and data errors.

1. Data Validation

1. Validate Required Fields

Many forms contain required fields; we can verify whether a field is empty. PHP functions empty() or isset() can be used to check if a field is empty.

Example code:

if (empty($_POST['username']) || empty($_POST['password'])) {
    echo "Username and password cannot be empty!";
    exit;
}

2. Validate Email Format

To verify that a user‑entered email matches a proper format, use the filter_var() function together with the FILTER_VALIDATE_EMAIL filter.

Example code:

$email = $_POST['email'];

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo "Invalid email format!";
    exit;
}

3. Validate Phone Number Format

Phone numbers can be validated with a regular expression.

Example code:

$phone = $_POST['phone'];

if (!preg_match("/^1[3456789]\d{9}$/", $phone)) {
    echo "Invalid phone number format!";
    exit;
}

2. Data Filtering

Data filtering removes illegal or unnecessary characters from user submissions. Common filtering methods include:

1. Filter HTML Tags

To prevent malicious HTML or scripts, use the strip_tags() function to strip HTML tags.

Example code:

$content = $_POST['content'];
$filteredContent = strip_tags($content);

2. Filter Special Characters

To escape special characters, use the htmlspecialchars() function.

Example code:

$content = $_POST['content'];
$filteredContent = htmlspecialchars($content);

3. Filter SQL Injection

To prevent malicious SQL statements, use the mysqli_real_escape_string() function to escape input before using it in queries.

Example code:

$username = $_POST['username'];
$password = $_POST['password'];

$username = mysqli_real_escape_string($con, $username);
$password = mysqli_real_escape_string($con, $password);

These are just some common validation and filtering methods; developers can customize additional rules based on specific requirements.

In summary, by employing PHP functions for form data validation and filtering, developers can ensure the safety and effectiveness of form inputs, improve user experience, and protect website security.